deps: move to rustls 0.23

crates/sandlock-core/Cargo.toml

@@ -25,13 +25,13 @@ walkdir = "2"
 toml = "0.8"
 jiff = "0.2"
 pathdiff = "0.2"
-tokio-rustls = "0.25"
-rustls = "0.22"
+tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] }
+rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12", "logging"] }
 rcgen = { version = "0.13", features = ["pem", "x509-parser"] }
 hyper = { version = "1", features = ["server", "client", "http1"] }
 hyper-util = { version = "0.1", features = ["client-legacy", "http1", "tokio"] }
 http-body-util = "0.1"
-hyper-rustls = "0.26"
+hyper-rustls = { version = "0.27", default-features = false, features = ["ring", "native-tokio", "http1", "tls12", "logging"] }
 tar = "0.4"
 clap = { version = "4", features = ["derive"], optional = true }
 bollard = "0.21"

crates/sandlock-core/src/transparent_proxy/mod.rs

@@ -54,7 +54,6 @@ pub(crate) async fn spawn_transparent_proxy(
     ca_key_pem: Option<&str>,
     log_fn: Option<Arc<dyn Fn(&str, &str, &str) + Send + Sync>>,
 ) -> std::io::Result<HttpAclProxyHandle> {
-    // rustls 0.22 builder() uses the ring provider directly; no provider install needed.
     let orig_dest: OrigDestMap =
         Arc::new(std::sync::RwLock::new(std::collections::HashMap::new()));
     let forwarder = Forwarder::new()?;
@@ -191,7 +190,10 @@ mod tests {
         // rustls client that trusts only the generated CA.
         let mut roots = rustls::RootCertStore::empty();
         roots.add(first_cert_der(&ca.cert_pem)).expect("add CA root");
-        let client_cfg = rustls::ClientConfig::builder()
+        let provider = Arc::new(rustls::crypto::ring::default_provider());
+        let client_cfg = rustls::ClientConfig::builder_with_provider(provider)
+            .with_safe_default_protocol_versions()
+            .expect("ring supports default protocol versions")
             .with_root_certificates(roots)
             .with_no_client_auth();
         let connector = TlsConnector::from(Arc::new(client_cfg));

crates/sandlock-core/src/transparent_proxy/tls.rs

@@ -58,7 +58,12 @@ impl CertSigner {
         // rcgen serialize_der() returns PKCS#8 DER.
         let key_der = PrivateKeyDer::Pkcs8(leaf_key.serialize_der().into());
 
-        let mut cfg = ServerConfig::builder()
+        // Explicit provider: the process-wide default is ambiguous whenever a
+        // downstream crate compiles in a second rustls backend.
+        let provider = Arc::new(rustls::crypto::ring::default_provider());
+        let mut cfg = ServerConfig::builder_with_provider(provider)
+            .with_safe_default_protocol_versions()
+            .map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, format!("server cfg: {e}")))?
             .with_no_client_auth()
             .with_single_cert(chain, key_der)
             .map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, format!("server cfg: {e}")))?;
@@ -74,8 +79,6 @@ mod tests {
     use super::*;
 
     fn test_ca() -> (String, String) {
-        // rustls 0.22 ServerConfig::builder() uses crypto::ring::default_provider()
-        // directly (no process-wide install needed, unlike rustls 0.23).
         let m = crate::transparent_proxy::resolve_ca(None, None, true).unwrap().unwrap();
         (m.cert_pem, m.key_pem)
     }

crates/sandlock-core/src/transparent_proxy/upstream.rs

@@ -25,7 +25,7 @@ impl Forwarder {
         // with_native_roots validates upstream against the host's system trust
         // store (default feature native-tokio). Returns io::Result.
         let connector = hyper_rustls::HttpsConnectorBuilder::new()
-            .with_native_roots()?
+            .with_provider_and_native_roots(rustls::crypto::ring::default_provider())?
             .https_or_http()
             .enable_http1()
             .build();